Fix: Potential Vulnerability in Cloned Function#3448
Fix: Potential Vulnerability in Cloned Function#3448tabudz wants to merge 1 commit intosonic-pi-net:devfrom
Conversation
The Windows Subsystem for Linux (WSL) is getting increasingly popular, in particular because it makes it _so_ easy to run Linux software on Windows' files, via the auto-mounted Windows drives (`C:\` is mapped to `/mnt/c/`, no need to set that up manually). Unfortunately, files/directories on the Windows drives can be accessed via their _short names_, if that feature is enabled (which it is on the `C:` drive by default). Which means that we have to safeguard even our Linux users against the short name attacks. Further, while the default options of CIFS/SMB-mounts seem to disallow accessing files on network shares via their short names on Linux/macOS, it _is_ possible to do so with the right options. So let's just safe-guard against short name attacks _everywhere_. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
Thanks for this - although it seems to mostly affect Windows users and the libgit2 in the tree isn't used on that platform in the build. Is this not something that can be remedied by switching to a more recent rugged release? |
|
There doesn't appear to be a more recent rugged release yet. |
|
Thanks for the reply! I’m using a tool that scans for vulnerable code clones, and it flagged the checkout_verify_paths() function in the vendored libgit2 here. The tool does not include the rugged repo yet so I haven't raised any concern there. Totally understand this may not affect the current build or platform, but I thought it was worth noticing. Happy to leave it up to you whether to fix it here or wait for upstream. |
3 participants
Description
This PR fixes a security vulnerability in checkout_verify_paths() that was cloned from libgit2 but did not receive the security patch. The original issue was reported and fixed under libgit2/libgit2@64c612c.
This PR applies the same patch to eliminate the vulnerability.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-12279
libgit2/libgit2@64c612c